Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the...

EUVD-2026-105135

Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance...

GHSA-VFPM-58RQ-9QCG Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the...

CVE-2026-112947

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...

PT-2026-118429

Name of the Vulnerable Software and Affected Versions Vite versions 8.2.0 through 8.2.3 Vite version 8.3.3 Description A flaw in the internal Wasm plugin's load hook allows the first 4 bytes of files located outside the server.fs setting to be returned to the browser. This occurs when a request...

Linux Distros Unpatched Vulnerability : CVE-2026-105800

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled languag...

Server-side Request Forgery (SSRF)

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via insufficient validation in isSafeUrlSegment functions in lib/utils.js,...

DEBIAN-CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

EUVD-2026-88626

pbkdf2 rehashes long passwords on every iteration, enabling denial of service...

ROOT-APP-NPM-GHSA-PMV8-RQ9R-6J72 GHSA-pmv8-rq9r-6j72 in axios - Patched by Root

Root has patched GHSA-pmv8-rq9r-6j72 in the axios package for Root:npm. Multiple fixed versions available...

CVE-2026-105800: Improper Neutralization of Special Elements in Output Used by a Downstream Component

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-103473

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

CVE-2026-103473

Deno versions 2.7.0 through 2.9.7 on Windows are vulnerable to a command injection flaw in the node:child_process component. The root cause is that shell arguments are incorrectly escaped for the wrong shell type. An attacker can inject OS commands by providing untrusted arguments when the shell ...

CVE-2026-103473 Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

CVE-2026-103473 Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

CVE-2026-103473 Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

EUVD-2026-90204

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

SUSE CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...